feat(middleware): harden routing with fail-closed policy, custom subdomain management, and perf fixes

- Fix IPv6 host parsing with _strip_port() utility
- Remove dangerous StorePlatform→Store.subdomain silent fallback
- Close storefront gate bypass when frontend_type is None
- Add custom subdomain management UI and API for stores
- Add domain health diagnostic tool
- Convert db.add() in loops to db.add_all() (24 PERF-006 fixes)
- Add tests for all new functionality (18 subdomain service tests)
- Add .github templates for validator compliance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/customers/tests/unit/test_customer_metrics.py

@@ -45,16 +45,15 @@ def cust_stores(db, cust_merchant):
     stores = []
     for i in range(2):
         uid = uuid.uuid4().hex[:8].upper()
-        store = Store(
+        stores.append(Store(
             merchant_id=cust_merchant.id,
             store_code=f"CSTORE_{uid}",
             subdomain=f"cstore{uid.lower()}",
             name=f"Cust Store {i}",
             is_active=True,
             is_verified=True,
-        )
-        db.add(store)
-        stores.append(store)
+        ))
+    db.add_all(stores)
     db.commit()
     for s in stores:
         db.refresh(s)
@@ -68,7 +67,7 @@ def cust_customers(db, cust_stores):
     # 3 customers in store 0
     for i in range(3):
         uid = uuid.uuid4().hex[:8]
-        c = Customer(
+        customers.append(Customer(
             store_id=cust_stores[0].id,
             email=f"cust_{uid}@test.com",
             hashed_password="hashed",  # noqa: SEC001
@@ -76,13 +75,11 @@ def cust_customers(db, cust_stores):
             last_name=f"Last{i}",
             customer_number=f"C{uid}",
             is_active=True,
-        )
-        db.add(c)
-        customers.append(c)
+        ))
     # 2 customers in store 1
     for i in range(2):
         uid = uuid.uuid4().hex[:8]
-        c = Customer(
+        customers.append(Customer(
             store_id=cust_stores[1].id,
             email=f"cust_{uid}@test.com",
             hashed_password="hashed",  # noqa: SEC001
@@ -90,9 +87,8 @@ def cust_customers(db, cust_stores):
             last_name=f"Last{i}",
             customer_number=f"C{uid}",
             is_active=True,
-        )
-        db.add(c)
-        customers.append(c)
+        ))
+    db.add_all(customers)
     db.commit()
     return customers